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CERTIFICATE OF MAILING 

I hereby certify that this correspondence is being deposited with the United States Postal Service as first class mail in an 
envelope addressed to: Mail Stop Amendment, Commissioner For Patents, P.O. Box 14S0, Alexandria, VA 22313-14S0. on 



the date shown below: 

Dated: 



Bv: ul^^^..J:y^:S^J^ 

Sabra-Anne R. Truesdale, Reg. NaT3g,687 



MAIL STOP AMENDMENT 
COMMISSIONER FOR PATENTS 
P.O. BOX 1450 

ALEXANDRIA, VA 22313-1450 



INFORMATION DISCLOSURE STATEMENT 
Under 37 CFR §§ 1.56 and 1.97-98 



SIR: 



Pursuant to the provisions of 37 CFR §§ 1.56 and 1.97-98, enclosed herewith is modified 
form PTO/SB/08A listing references for consideration by the Examiner. 

The filing of this Information Disclosure Statement shall not be construed as a 
representation regarding the completeness of the list of references, or that inclusion of a reference 
in this list is an admission that it is prior art or is pertinent to this application, or that a search has 
been made, or as an admission that the information listed is, or may be considered to be, material 
to patentability, or that no other material information exists, and shall not be construed as an 
admission against interest in any manner. 

This Information Disclosure Statement is being filed: 

□ within three months of the filing date of the application, or date of entry 
into the national stage of an international application, or before the mailing 
date of a first office action on the merits, whichever event last occurred; 

□ before the mailing of a first official action after the filing of a request for 

continued examination (RCE) under 37 CFR § 1.114; 
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^ after three months of the filing date of this national application or the date 
of entry of the national stage in an international application, or after the 
mailing date of the first official action on the merits, whichever event last 
occurred, but before the mailing date of the first to occur of either: (1) a 
final action under 37 CFR §1.113; or (2) an action that otherwise closes 
prosecution in the application, and: 

^ attached hereto is the fee set forth under 37 CFR § 1 . 17(p) for 
submission of this Information Disclosure Statement under 37 
CFR.§ 1.97(c); OR 

□ Applicant certifies pursuant to 37 CFR § L97(e) that: 

□ each item of information contained in this Information 
Disclosure Statement was first cited in a communication 
from a foreign patent office in a counterpart foreign 
application not more than three months prior to the filing of 
this Statement; OR 

□ no item of information contained in this Information 
Disclosure Statement was cited in a communication from a 
foreign patent office in a counterpart foreign application 
and, to the knowledge of the person signing this 
certification after making reasonable inquiry, no item of 
information contained in this Statement was known to any 
individual designated under 37 CFR § 1.56(c) more than 
three months prior to the filing of this Statement; 

□ on or before the payment of the issue fee but after the mailing date of the 
first to occur of either: (1) a final action under 37 CFR § 1.113; (2) a 
notice of allowance under 37 CFR § 1.31 1; or (3) an action that otherwise 
closes prosecution in the application, and: 

□ Applicant certifies pursuant to 37 CFR. § 1.97(e) that: 

□ each item of information contained in this Information 
Disclosure Statement was cited in a communication from a 
foreign patent office in a counterpart foreign application not 
more than three months prior to the filing of this Statement; 

□ no item of information contained in this Information 
Disclosure Statement was cited in a communication from a 
foreign patent office in a counterpart foreign application 
and, to the knowledge of the person signing this 
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certification after making reasonable inquiry, no item of 
information contained in this Statement was known to any 
individual designated under 37 CFR § L56(c) more than 
three months prior to the filing of this Statement; AND 
□ attached hereto is the fee set forth under 37 CFR § 1 . 17(p) for 

submission of this Information Disclosure Statement under 37 

CFR.§ 1.97(d); OR 

□ after the payment of the issue fee. Applicant requests that the information 
contained in this Information Disclosure Statement be placed in the file 
according to 37 CFR § 1.97(i), although the information may not be 
considered by the USPTO. 

□ Enclosed is a copy of each listed reference that may be material to the 
examination of this application, and for which there may be a duty to disclose. 

□ This application relies, under 35 U.S.C. § 120, on the earlier filing date of prior 

application No. , filed on , and the references cited therein are 

hereby referenced, but are not required to be provided in this application under 37 
CFR § 1.98(d). 

^ Copies of any foreign patent documents and non-patent literature cited herein are 
enclosed. 

□ Each item of information contained in this Information Disclosure Statement was 
cited in a communication from a foreign patent office in a counterpart application, 
and the communication was not received by any individual designated in 37 CFR 
§ 1.56(c) more than thirty days prior to the filing of this Information Disclosure 
Statement. 37 CFR § 1.704(d). 

□ Applicant submits that no fee is required for the consideration of this Information 

Disclosure Statement. 

Consideration of the listed references and favorable action are solicited. 

Respectfully submitted, 
HUGHS.NJEMANZE 

Dated: By: ^ 

Sabra-Anne R. Truesdale, Reg. No.: 55,687 

Fenwick & West LLP 

Silicon Valley Center 

801 California Street 

Mountain View, CA 94041 

Tel.: (650)335-7187 

Fax.: (650) 938-5200 
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Porras et al. 
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Porras et al. 
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03-16-2004 


Porras et al. 
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03-09-2004 
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05-15-2003 


Valdes et al. 
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05-15-2003 


Porras 
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05-29-2003 


Porras et al. 




A10 


US-6,484,203 


11-19-2002 


Porras et al. 




All 


US-6,321,338 


11-20-2001 


Porras et at. 
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02-10-1998 


Kodavalla et al. 
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Cite 
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Number* 
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Publication Date 
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Name of Patentee or 
Applicant of Cited Document 

















OTHER REFERENCES - NON-PATENT LITERATURE DOCUMENTS 
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Cite 
No.' 


Include name of the author (in CAPITAL LETTERS), title of the article (when appropriate), title of the item (book, magazine, 
journal, serial, symposium, catalog, etc.), date, page(s), volume-issue number(s). publisher, city and/or country wtiere 

published 


T* 




CI 


ARCSIGHT, "About ArcSight Team." date unknown, [online] [Retrieved on October 25, 2002] Retrieved from the Internet 

<URL: http://www.arcsight.com/about_team.htm>. 






C2 


ARCSIGHT, "About Oven/iew," October 14, 2002, [online] [Retrieved on April 21 , 2006] Retrieved from the Internet <URL: 
httpy/web.archive.org/web/20021 01 4041 61 4/http://www.arcsight.com/about.htm>. 






C3 


ARCSIGHT, "Contact Info," date unknown, [online] [Retrieved on October 25, 2002] Retrieved from the Internet <URL: 
http://www.arcsight.com/contact.htm>. 





Examiner 




Date 




Signature 




Considered 





* EXAMINER: Initial if reference considered, whether or not citation is in conformance with MPEP 609. 

Draw line through citation if not in conformance and not consklered. Include copy of this form with next communication to applicant. 

'Applicant's unique citation designation number (optional). %ee Kinds Codes of USPTO Patent Documents at www.uspto.gov or MPEP 901.04. ^Enter Office that 
issued the document, by the two-letter code (WlPO Standard ST.3). *For Japanese patent documents, the indication of the year of the reign of the Emperor must 
precede the serial number of the patent document. ^Kind of document by the appropriate symtx)ls as indicated on the document under WlPO Standard ST. 16 if 
possible. ^Applicant is to place a check mark here if English language Translation is attached. 
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AROStGHT, "Enterprise Coverage: Technology Architecture," date unknown, [online] Retrieved from the Internet <URL: 
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http://www.snaiso.com/Documentation/Arcsight/arcsight_console.pdf>. 






07 
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Retrieved from the Internet <URL: http://www.arcsight.com/product.htm>. 
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AROSIGHT, "Security Management for the Enterprise," 2002. [online] (Retrieved on October 25, 2002] Retrieved from the 
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ARCSIGHT, "Technical Brief: How Correlation Eliminates False Positives," date unknown, source unknown. 






019 


BURLESON. □., Taking Advantage of Object Partitioning in OradeSi." November 8, 2000, (online] [Retrieved on April 20, 
2004] Retrieved from the Internet <URL: http://www.dba-oracle.com/art_partit.htm>. 
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DERODEFF, 0. "Got Correlation? Not Without Nomialization," 2002, (online] Retrieved from the Internet <URL: 
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C27 


LINDQVIST, U. et al., "Detecting Computer and Networit Misuse Through the Production-Based Expert System Toolset (P- 
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